diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index 76b9f07443..302bd2e25f 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -16,7 +16,7 @@ description: The following analytic identifies one source endpoint failing to au This detection will trigger on the domain controller against which the offending host performs the password spraying attack. The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -search: ' `wineventlog_security` EventCode=4768 Result_Code=0x12 | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address | where unique_accounts > 10' +search: ' `wineventlog_security` EventCode=4768 Result_Code=0x12 | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address | where unique_accounts > 10' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting 'Audit Kerberos Authentication Service' within 'Account Logon' needs to be enabled. known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios @@ -35,4 +35,8 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_.yml index 134a4f9292..b2af74025b 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_.yml @@ -35,4 +35,8 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index 9d248fb056..4f73b538bf 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -39,4 +39,8 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - action + - Logon_Account + - Source_Workstation security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticae_from_host_using_ntlm.ym b/detections/endpoint/multiple_users_failing_to_authenticae_from_host_using_ntlm.ym index 48f1d3c71e..cf15a4feeb 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticae_from_host_using_ntlm.ym +++ b/detections/endpoint/multiple_users_failing_to_authenticae_from_host_using_ntlm.ym @@ -39,4 +39,8 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - action + - Logon_Account + - Source_Workstation security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 2349c4d70e..fb6c872c5b 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -37,5 +37,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml index 9cbac2217a..3e1e56c111 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml @@ -17,7 +17,7 @@ description: The following analytic identifies a source process name failing to The analytic's returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. -search: ' `wineventlog_security` EventCode=4625 Logon_Type=2  Caller_Process_Name!="-" | eval Source_Account = mvindex(Security_ID, 0) | eval Destination_Account = mvindex(Account_Name, 1)  | stats  dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by Caller_Process_Name, Source_Account, ComputerName  | where  unique_accounts > 10' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2  !="-" | eval Source_Account = mvindex(Security_ID, 0) | eval Destination_Account = mvindex(Account_Name, 1)  | stats  dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by Caller_Process_Name, Source_Account, ComputerName  | where  unique_accounts > 10' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. known_false_positives: A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios @@ -40,4 +40,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Logon_Type + - Caller_Process_Name + - Security_ID + - Account_Name + - ComputerName security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml index 27185db670..54103e1008 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml @@ -39,4 +39,8 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Security_ID + - Account_Name + - ComputerName security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index bb298b1f0e..afb27af24d 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -38,5 +38,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - _time + - EventCode + - Logon_Type + - Security_ID + - Account_Name + - ComputerName + - Source_Network_Address security_domain: endpoint \ No newline at end of file